Critical-severity CVEs (page 2)
Page 2 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-101008 | Critical | 9.1 | 2026-09-28 | A vulnerability was found in aaPanel BaoTa up to 11.8.0. Impacted is the function merge_split_file of the file /www/server/panel/class/files.py of the componen… |
CVE-2026-101002 | Critical | 9.9 | 2026-09-28 | A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. Affected is the function system of the file /usr/bin/network_tools of the component… |
CVE-2026-101001 | Critical | 10.0 | 2026-09-28 | A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This impacts the function eval of the file /www/cgi-bin/network_tools of the component We… |
CVE-2026-101000 | Critical | 10.0 | 2026-09-28 | A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. This affects the function uci.apply of the file /usr/share/rpcd/acl.d/unauthenticated.jso… |
CVE-2026-100896 | Critical | 9.9 | 2026-09-28 | A weakness has been identified in TOTOLINK N150RT 3.4.0-B20201030. The affected element is the function system of the file /boafrm/formWlSiteSurvey of the comp… |
CVE-2026-100886 | Critical | 10.0 | 2026-09-27 | A vulnerability was identified in Seetong T8108, T8108P, T8116 and T8232 4.6.1.4-build202604241011. The affected element is an unknown function of the componen… |
CVE-2026-101090 | Critical | 9.8 | 2026-09-27 | Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint. When the new optional dashboard_host setting is empty, /api/v1/oauth2/… |
CVE-2026-101084 | Critical | 9.6 | 2026-09-27 | obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP se… |
CVE-2026-101065 | Critical | 9.8 | 2026-09-27 | Obot is an open-source AI agent/MCP platform. In all versions up to and including commit d7e6970, the Docker quickstart command documented in the README starts… |
CVE-2026-88777 | Critical | 9.8 | 2026-09-27 | Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23… |
CVE-2026-88776 | Critical | 9.8 | 2026-09-27 | Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23… |
CVE-2026-88775 | Critical | 9.8 | 2026-09-27 | Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-… |
CVE-2026-88773 | Critical | 10.0 | 2026-09-27 | Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issu… |
CVE-2026-88771 | Critical | 9.8 | 2026-09-27 | Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, be… |
CVE-2026-100741 | Critical | 9.8 | 2026-09-27 | Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allows a remote, unauthe… |
CVE-2026-100721 | Critical | 9.0 | 2026-09-27 | vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures `require.external` with a custom resolve… |
CVE-2026-100740 | Critical | 9.9 | 2026-09-27 | A vulnerability was detected in D-Link DIR-895L A1_102b07. Impacted is the function tunnel_set_params of the file tunnel.c of the component L2TP Control Channe… |
CVE-2026-82901 | Critical | 9.8 | 2026-09-26 | The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7_wpcf7_ma… |
CVE-2026-85984 | Critical | 9.8 | 2026-09-26 | The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mo_wp_login_intent parameter i… |
CVE-2026-100717 | Critical | 9.9 | 2026-09-26 | froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return and line feed characters only in the pa… |
CVE-2026-100716 | Critical | 9.9 | 2026-09-26 | Froxlor is a server administration panel. In versions 2.3.10 and earlier, the customer data-export (DataDump) cron fails to validate intermediate path componen… |
CVE-2026-100715 | Critical | 9.6 | 2026-09-26 | Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task. Cron task 8 (deleteFtpData), queued w… |
CVE-2026-100714 | Critical | 9.1 | 2026-09-26 | Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting: unlike sibling settings hardened in GHSA-33mp, the field has no… |
CVE-2026-100706 | Critical | 9.9 | 2026-09-26 | kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace cl… |
CVE-2026-18143 | Critical | 9.8 | 2026-09-26 | The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the `afrfq_subm… |
CVE-2026-97064 | Critical | 9.1 | 2026-09-25 | X-SpringBoot through 6.0 ships with a hardcoded static master login verification code 172839 enabled by default in the database seed. Unauthenticated attackers… |
CVE-2026-97063 | Critical | 9.1 | 2026-09-25 | X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys/email/code without… |
CVE-2026-92161 | Critical | 9.8 | 2026-09-25 | FriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Facebook, and other providers. Prior to 1.7.4 and 2.0.0-beta.4, the Discord OAuth… |
CVE-2026-62262 | Critical | 9.1 | 2026-09-25 | Piwigo is a full featured open source photo gallery application for the web. In 17.0.0beta1 and earlier, when rating is enabled, an unauthenticated guest can c… |
CVE-2026-42322 | Critical | 9.1 | 2026-09-25 | Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/themes_standard_pages.php validates uploaded logo content b… |
CVE-2026-39353 | Critical | 9.1 | 2026-09-25 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-rc-1, InvoicePlane builds its permitted temp… |
CVE-2026-93647 | Critical | 9.3 | 2026-09-25 | An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS… |
CVE-2026-93643 | Critical | 9.8 | 2026-09-25 | When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsi… |
CVE-2026-93642 | Critical | 9.3 | 2026-09-25 | An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the at… |
CVE-2026-93641 | Critical | 9.3 | 2026-09-25 | An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing the a… |
CVE-2026-100075 | Critical | 9.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters When srpt_alloc_rw_ctxs() fails partw… |
CVE-2026-92609 | Critical | 9.8 | 2026-09-25 | Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a se… |
CVE-2026-93399 | Critical | 9.1 | 2026-09-25 | The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'bookly_get_form_id', 'bookly_… |
CVE-2026-89055 | Critical | 9.1 | 2026-09-25 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.120.0. This is due to t… |
CVE-2026-14281 | Critical | 9.8 | 2026-09-25 | The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Privilege Escalation in all ve… |
CVE-2026-92289 | Critical | 9.1 | 2026-09-25 | Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPoint… |
CVE-2026-92288 | Critical | 9.1 | 2026-09-25 | Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndP… |
CVE-2026-97230 | Critical | 9.8 | 2026-09-24 | IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL. The generate_certificate runs a Py… |
CVE-2026-95699 | Critical | 9.6 | 2026-09-24 | Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, which can expose other users' d… |
CVE-2026-93291 | Critical | 9.4 | 2026-09-24 | Omni C20 lacks proper certificate validation which could allow an attacker to perform a man-in-the-middle attack which could allow them to execute arbitrary co… |
CVE-2026-13249 | Critical | 9.8 | 2026-09-24 | An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F… |
CVE-2026-61741 | Critical | 9.3 | 2026-09-24 | http4s-scala-xml provides `EntityDecoder[F, scala.xml.Elem]` instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders us… |
CVE-2026-61732 | Critical | 10.0 | 2026-09-24 | Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissance against target se… |
CVE-2026-97413 | Critical | 9.8 | 2026-09-24 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Fix integer underflow in process_read and process_write usr_len is read fr… |
CVE-2026-88378 | Critical | 9.8 | 2026-09-24 | QuickJS commit 04be24600 contains a heap out-of-bounds write condition in JS_ReadFunctionTag(). |
CVE-2026-79766 | Critical | 9.1 | 2026-09-24 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.1 until 2.5.1, an authenticated Termix a… |
CVE-2026-93425 | Critical | 9.9 | 2026-09-24 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPa… |
CVE-2026-93228 | Critical | 9.1 | 2026-09-24 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Write/Reply chunks with segcount 0 A peer can send a Write or Reply chunk… |
CVE-2026-93207 | Critical | 9.8 | 2026-09-24 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry svcauth_gss_decode_… |
CVE-2026-88365 | Critical | 9.8 | 2026-09-24 | minimp3 commit ea99364f contains an integer overflow vulnerability in mp3dec_skip_id3v1() when parsing the APEv2 tag-size field. |
CVE-2026-88351 | Critical | 9.8 | 2026-09-24 | An integer overflow vulnerability exists in the MPack Node API in MPack 1.1.1 on 32-bit platforms. When parsing a specially crafted MessagePack array32 or map3… |
CVE-2026-81549 | Critical | 9.6 | 2026-09-24 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of the X-For… |
CVE-2026-51996 | Critical | 9.8 | 2026-09-24 | An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the src/lib/utils.ts and the getServerUrlHash functi… |
CVE-2026-51994 | Critical | 9.1 | 2026-09-24 | mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery (SSRF) via the resource_metadata URL extracted from a remote MCP server… |
CVE-2026-97360 | Critical | 10.0 | 2026-09-24 | HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access vulnerability that allows unauthenticated attackers to read, write, append, an… |
CVE-2026-97359 | Critical | 10.0 | 2026-09-24 | HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve rem… |
CVE-2026-19072 | Critical | 9.9 | 2026-09-24 | Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field… |
CVE-2026-12227 | Critical | 9.8 | 2026-09-24 | The Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 45.16.0 via the `vcv-templ… |
CVE-2026-78312 | Critical | 9.1 | 2026-09-24 | Path Traversal in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022. |
CVE-2026-78308 | Critical | 9.8 | 2026-09-24 | Improper Authentication vulnerability in DIAEnergie allows Authentication Bypass. This issue affects DIAEnergie: before 1.11.00.022. |
CVE-2026-96891 | Critical | 9.8 | 2026-09-24 | A vulnerability was identified in D-Link DIR-825 3.00b32. Affected is the function tunnel_set_params of the file tunnel.c of the component rp-l2tp. The manipul… |
CVE-2026-18467 | Critical | 9.8 | 2026-09-24 | The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.3. The 5.0.3… |
CVE-2026-93577 | Critical | 9.9 | 2026-09-24 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain co… |
CVE-2026-89078 | Critical | 9.9 | 2026-09-24 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain co… |
CVE-2026-93352 | Critical | 9.8 | 2026-09-23 | Laravel-Mediable 7.0.0 before 7.0.2 contains an incomplete patch for CVE-2026-49972 in which the .pht extension is absent from the forbidden_extensions blockli… |
CVE-2026-6928 | Critical | 9.8 | 2026-09-23 | IBM Concert 1.0.0 through 3.0.0 references or accesses memory after it has been freed. This allows an attacker who can influence program execution or input may… |
CVE-2026-6730 | Critical | 9.8 | 2026-09-23 | IBM Concert 1.0.0 through 3.0.0 is vulnerable to a buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbi… |
CVE-2026-6721 | Critical | 9.8 | 2026-09-23 | IBM Concert 1.0.0 through 3.0.0 allows an unauthenticated remote attacker can supply specially crafted input that is incorporated into OS commands, resulting i… |
CVE-2026-84719 | Critical | 9.9 | 2026-09-23 | A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates o… |
CVE-2026-75884 | Critical | 9.1 | 2026-09-23 | A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing in… |
CVE-2026-95601 | Critical | 9.3 | 2026-09-23 | Unauthenticated SQL Injection in Product Filter by WBW <= 3.1.7 versions. |
CVE-2026-84502 | Critical | 9.9 | 2026-09-23 | A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Project scm_url field is not validated against values that begin with a d… |
CVE-2026-84474 | Critical | 9.9 | 2026-09-23 | A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The provisioning-callback secret (host_config_key) is exposed to users holdin… |
CVE-2026-77602 | Critical | 9.9 | 2026-09-23 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.1.0 until 7.3.0, authenticated n… |
CVE-2026-86934 | Critical | 9.1 | 2026-09-23 | An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an extended privilege header to bypass the disa… |
CVE-2026-86930 | Critical | 9.1 | 2026-09-23 | An out-of-bounds read vulnerability in FileMaker Server for Linux allowed an attacker uploading a specially crafted image file to a container field to disclose… |
CVE-2026-96759 | Critical | 9.8 | 2026-09-23 | orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. Attackers can in… |
CVE-2026-96758 | Critical | 9.8 | 2026-09-23 | orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated… |
CVE-2026-96757 | Critical | 9.8 | 2026-09-23 | orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. Attackers can… |
CVE-2026-96755 | Critical | 9.8 | 2026-09-23 | orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template… |
CVE-2026-96754 | Critical | 9.8 | 2026-09-23 | orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted rout… |
CVE-2026-95848 | Critical | 9.1 | 2026-09-23 | Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthentic… |
CVE-2026-85724 | Critical | 9.6 | 2026-09-23 | Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes cl… |
CVE-2025-63564 | Critical | 9.8 | 2026-09-23 | SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP requests |
CVE-2026-18872 | Critical | 9.3 | 2026-09-23 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to stored cross-site scripting (CWE-79) in the FTM UI NetworkAcknowledgement React c… |
CVE-2026-96560 | Critical | 9.8 | 2026-09-23 | LightLLM through 1.2.0 contains a remote code execution vulnerability in the KV-transfer worker when started with --pd_trans_mode nccl, which exposes an unauth… |
CVE-2026-86708 | Critical | 10.0 | 2026-09-23 | ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private key in the Applicati… |
CVE-2026-59167 | Critical | 10.0 | 2026-09-23 | SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/lib/core.js does not… |
CVE-2026-86246 | Critical | 9.1 | 2026-09-23 | Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOT… |
CVE-2026-19599 | Critical | 9.9 | 2026-09-23 | ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below were vulnerable to a Remote Code Execution vulnerability in the Notification Profile module. |
CVE-2026-86350 | Critical | 9.1 | 2026-09-23 | Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41… |
CVE-2026-86248 | Critical | 9.8 | 2026-09-23 | CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affects Apache… |
CVE-2026-76183 | Critical | 9.8 | 2026-09-23 | Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issu… |
CVE-2026-82331 | Critical | 9.8 | 2026-09-23 | Improper link resolution before file access ('link following') vulnerability in the `tar` source plugin of Apache BuildStream running on Python < 3.12 allows m… |
CVE-2026-82843 | Critical | 9.0 | 2026-09-23 | The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization g… |